Overview

overview

10

Static

static

5

ee86a7548f...18.exe

windows7-x64

10

ee86a7548f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee86a7548f154536339f671846623c07_JaffaCakes118.exe

  • Size

    814KB

  • MD5

    ee86a7548f154536339f671846623c07

  • SHA1

    edf0857d32145811d771383e0e1963a64cc59a78

  • SHA256

    feeba33f7c211e4131a4b180562d0989716143b6ef3f79c047ffdd91c6181b38

  • SHA512

    6a5d4f08a05af29ff70171d4fd7b8a1e4691845eaa83f3af001c5346478606194fd33a077cde145c8b62de24d7d60ee272aa1ad820a9732c2641fe1a59c416ce

  • SSDEEP

    12288:s69zDWz/xwNqdlbrIX3JALF1QbOagrEGgtNryyCJuDT/PNa0AYQ/HywPtDt4:s2DW/xbHX2YIbCQsu3/PNL7Q/Hywtx4

Score
10/10
discoveryevasionpersistencespywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee86a7548f154536339f671846623c07_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee86a7548f154536339f671846623c07_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\winnt.exe
      C:\Windows\winnt.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5068
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C AT /delete /yes
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\system32\at.exe
        AT /delete /yes
        3⤵
          PID:2272
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winfiles.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\system32\at.exe
          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winfiles.exe
          3⤵
            PID:3540

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Hide Artifacts

      2
      T1564

      Hidden Files and Directories

      2
      T1564.001

      Modify Registry

      4
      T1112

      Credential Access

      Unsecured Credentials

      2
      T1552

      Credentials In Files

      2
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      1
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\winnt.exe
        Filesize

        66KB

        MD5

        849d464889750e83489da517712b3e7f

        SHA1

        c6f53486af2d52b52b0eea300d63a751fad9ebb0

        SHA256

        dee5b490ee1a418576d9716040efaa649c1d014c691aecbfb5daa3154c2b32fe

        SHA512

        abeeb3fb3b4fc45d82f4414bfba416294ef80fbc1271efb05045d57f2b9f696c832f6c3966516ec86590509f848f59ea7cb1366ce323717d10e8bba390799bd8

        Download Submit

      • memory/5068-11-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

        Download

      • memory/5068-13-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

        Download

      • memory/5068-15-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

        Download

      • memory/5068-14-0x0000000000418000-0x0000000000419000-memory.dmp

        Filesize

        4KB

        Download

      • memory/5068-23-0x0000000000400000-0x0000000000424000-memory.dmp

        Filesize

        144KB

        Download